CLEANSTART-2026-LO23632 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the langfuse package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-HY63925 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the langfuse package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-BO31904 Security fix for GHSA-f88m-g3jw-g9cj applied in: langfuse-worker 3.225.9-r3

Security vulnerability affects the langfuse-worker package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-UG53447 Security fix for GHSA-rgj7-g3m4-5g8c applied in: langfuse-worker 3.225.9-r3

Security vulnerability affects the langfuse-worker package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-PO83122 Security fix for GHSA-2xp9-vwfh-vxw4 applied in: langfuse-worker 3.225.9-r3

Security vulnerability affects the langfuse-worker package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-JG00673 uuid before 14

Security vulnerability affects the langfuse-worker package. uuid before 14...

CLEANSTART-2026-DF16083 Security fix for CVE-2026-45820 applied in: langfuse-worker 3.225.9-r3

Security vulnerability affects the langfuse-worker package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-LG90193 Next

Security vulnerability affects the langfuse-worker package. Next...

CLEANSTART-2026-LJ34730 node-csv is a full-featured CSV parser with a simple API that is tested against large datasets

Security vulnerability affects the langfuse-worker package. node-csv is a full-featured CSV parser with a simple API that is tested against large datasets...

CLEANSTART-2026-SY59629 PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree

Security vulnerability affects the langfuse-worker package. PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree...

CLEANSTART-2026-VU21760 source-map-js through 1

Security vulnerability affects the langfuse-worker package. source-map-js through 1...

CLEANSTART-2026-BZ86310 Security fix for GHSA-wq5f-xc86-pv6w applied in: langfuse-worker 3.225.9-r5

Security vulnerability affects the langfuse-worker package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-ML15245 deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects

Security vulnerability affects the langfuse-worker package. deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects...

CLEANSTART-2026-CD82080 undici's cache interceptor mishandles malformed Cache-Control private directives

Security vulnerability affects the langfuse-worker package. undici's cache interceptor mishandles malformed Cache-Control private directives...

CLEANSTART-2026-ZG01610 uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs

Security vulnerability affects the langfuse-worker package. uuid is for the creation of RFC9562 formerly RFC4122 UUIDs...

CLEANSTART-2026-UY47455 When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint

CVE-2026-33810 affects multiple packages. When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. See references for individual vulnerability details...

CLEANSTART-2026-XR10051 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

CVE-2026-39821 affects multiple packages. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

CLEANSTART-2026-YY31945 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

CVE-2026-56862 affects multiple packages. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. See references for individual vulnerability details...

CLEANSTART-2026-XF04805 On Unix systems, opening a file in an os

CVE-2026-39822 affects multiple packages. On Unix systems, opening a file in an os. See references for individual vulnerability details...

CLEANSTART-2026-VN37726 Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations

CVE-2026-39820 affects multiple packages. Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. See references for individual vulnerability details...

CLEANSTART-2026-RE57031 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

CVE-2026-42504 affects multiple packages. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. See references for individual vulnerability details...

CLEANSTART-2026-GD90779 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

CVE-2026-56853 affects multiple packages. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. See references for individual vulnerability details...

CLEANSTART-2026-GR33077 Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service

CVE-2026-32281 affects multiple packages. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. See references for individual vulnerability details...

CLEANSTART-2026-AN71108 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

CVE-2026-33814 affects multiple packages. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. See references for individual vulnerability details...

CLEANSTART-2026-AC13048 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

CVE-2026-33811 affects multiple packages. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. See references for individual vulnerability details...

CLEANSTART-2026-GC49284 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

CVE-2026-33818 affects multiple packages. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. See references for individual vulnerability details...

CLEANSTART-2026-NM19366 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

CVE-2026-46600 affects multiple packages. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...

CLEANSTART-2026-SI29829 Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)

CVE-2026-39836 affects multiple packages. The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL 0. See references for individual vulnerability details...

CLEANSTART-2026-PT37240 If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources

CVE-2026-32283 affects multiple packages. If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. See references for individual vulnerability details...

CLEANSTART-2026-ZJ82882 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

CVE-2026-42499 affects multiple packages. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. See references for individual vulnerability details...

CLEANSTART-2026-PO03838 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

CVE-2026-56859 affects multiple packages. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. See references for individual vulnerability details...

CLEANSTART-2026-QB50349 Actions which insert URLs into the content attribute of HTML meta tags are not escaped

CVE-2026-27142 affects multiple packages. Actions which insert URLs into the content attribute of HTML meta tags are not escaped. See references for individual vulnerability details...

CLEANSTART-2026-OG70620 (*x509

CVE-2026-27145 affects multiple packages. x509. See references for individual vulnerability details...

CLEANSTART-2026-FF43574 Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used

CVE-2026-32289 affects multiple packages. Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. See references for individual vulnerability details...

CLEANSTART-2026-IG95485 On Linux, if the target of Root

CVE-2026-32282 affects multiple packages. On Linux, if the target of Root. See references for individual vulnerability details...

CLEANSTART-2026-FK00511 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

CVE-2026-39823 affects multiple packages. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. See references for individual vulnerability details...

CLEANSTART-2026-DK87563 url

CVE-2026-25679 affects multiple packages. url. See references for individual vulnerability details...

CLEANSTART-2026-KO38637 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

CVE-2026-56858 affects multiple packages. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. See references for individual vulnerability details...

CLEANSTART-2026-JP32193 When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will...

CVE-2026-27137 affects multiple packages. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint wil...

CLEANSTART-2026-OX66799 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

CVE-2026-39826 affects multiple packages. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block. See references for individual...

CLEANSTART-2026-ZA45102 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

CVE-2026-32280 affects multiple packages. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details...

CLEANSTART-2026-ZD32814 Previously, resolving relative paths containing parent directory ('

CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...

CLEANSTART-2026-SJ77898 Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints

CVE-2026-27138 affects multiple packages. Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. See references for individual vulnerability details...

CLEANSTART-2026-SO98691 Security fix for GHSA-r92c-9c7f-3pj8 applied in: opentofu 1.11.4-r0

Security vulnerability affects the opentofu package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-KG46723 When returning errors, functions in the net/textproto package would include its input as part of the error

CVE-2026-42507 affects multiple packages. When returning errors, functions in the net/textproto package would include its input as part of the error. See references for individual vulnerability details...

CLEANSTART-2026-KI17515 tar

CVE-2026-32288 affects multiple packages. tar. See references for individual vulnerability details...

CLEANSTART-2026-NF29170 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-24051 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-KB59270 malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go ...

CVE-2026-56865 affects multiple packages. A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. See references for individual vulnerabilit...

CLEANSTART-2026-VP63638 CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs

CVE-2026-1229 affects multiple packages. The CombinedMult function in the CIRCL ecc/p384 package secp384r1 curve produces an incorrect value for specific inputs. See references for individual vulnerability details...

CLEANSTART-2026-UQ14392 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

CVE-2026-42505 affects multiple packages. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. See references for individual vulnerability details...